Trump Mobile Leak: What Happened to Customer Info
Trump Mobile appears to have had a data leak affecting 3,615 people. The incident was reported on Oct. 6, 2026, and involves customer order records held in systems linked to the branded wireless service. The Verge
The leaked data includes names, home addresses, emails, phone numbers and order details. That mix of personal information plus what people ordered could be used for identity theft, taking over phone numbers, fake emails and mail scams. Security researchers described the same list for the 3,615 users. Cybernews
Several people named in the leak told PCMag and Straight Arrow News the details about them were correct. Hearing directly from those people shows live customer records were involved.
The leak also includes information tied to Eric Brunnett, chief information technology officer at The Trump Organization. His presence alone does not show how big the breach is. It does raise questions about whether internal admin accounts were kept separate from customer order storage.
A hacking group calling itself BYOD claimed responsibility. It was described as a newly started ransomware gang, a group that steals data and asks for money. Straight Arrow News
A BYOD member told PCMag they got in by placing a remote access trojan on the computer of a Liberty Mobile employee. Think of it like a hidden remote control for someone else's computer, used to steal passwords, take over logins, and reach internal websites and private networks. Liberty Mobile is the carrier that runs Trump Mobile's network. That points to entry through a partner, not a direct attack on Trump Mobile's public site.
BYOD also claims to have access to the backend of Trump Mobile's website, meaning admin or database control. That claim is separate from the order data now being shared. The shared data alone does not prove they still have that access.
Branded services like this normally borrow a larger carrier for setting up service, billing help and running the network. So if an attacker gets into a carrier worker's computer, they can move into shared support tools and customer systems.
In my view, the way reporters checked the data is the most useful part. They called people listed in the data. That work is slow but more trusted than taking an attacker's word for the number. Fixing this will require checking logs on both the Trump Mobile side and the carrier support side.
The broader context for defenders here is the gap between stolen data and claimed access. A table of 3,615 orders suggests either a small slice was taken or only a small store was reached. A backend claim suggests wider control. Both can be true, since attackers often leak a little while keeping access to ask for money. Until computer and login records are checked, the published number should be treated as a minimum.
Looking ahead, the cleanup is basic but tedious. It includes changing passwords for shared support accounts, checking app permissions and remote sessions tied to Liberty Mobile staff, isolating affected computers, and hunting for hidden software and quiet check-ins with attacker computers. Customer notices and credit monitoring will follow if company checks confirm the leak. The long arc stays hopeful if small operators learn that hiring out network work does not hire out security duty.
